An open-source framework for building hardware-enforced trusted execution environments (TEEs) on RISC-V processors.
Keystone is an open-source framework for building trusted execution environments (TEEs) on RISC-V processors. It enables hardware-enforced memory isolation for confidential computing, allowing secure execution of sensitive code even on untrusted platforms. The framework is designed to be platform-agnostic, making it portable across different RISC-V hardware with minimal customization.
Researchers, hardware designers, and developers working on secure systems who need to implement or experiment with trusted execution environments on RISC-V architectures.
Keystone reduces the cost and complexity of building TEEs by providing a reusable, customizable framework that supports both academic research and production deployment. Its open-source nature and platform-agnostic design offer flexibility not found in proprietary solutions.
Keystone Enclave (QEMU + HiFive Unleashed)
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports standard RISC-V ISA and sub-ISAs, enabling portability across different RISC-V platforms with minimal engineering effort, as stated in its goal to enable TEE on almost all RISC-V processors.
Allows TEE features to be customized using platform-specific primitives or non-standard sub-ISAs, borrowing from software-defined networking for flexible adaptation to various security needs.
Reuses implementation across platforms to reduce hardware integration, verification, and development costs, making novel TEE designs more accessible and affordable.
Evolved from a research tool to an incubation-stage project with industry-standard cryptography and protocols, facilitating the transition from academic ideas to production-ready systems.
Requires a hardware root of trust and specific RISC-V features (e.g., PMP registers) that are not universally available, and it lacks built-in high-performance memory encryption, relying on software-based methods that may limit performance.
As an incubation-stage project, Keystone is still evolving towards production-readiness, which can introduce breaking changes, incomplete features, or less robustness compared to established TEE solutions.
Focused on RISC-V and relatively new, it has a smaller community, fewer integrated tools, and less vendor support than TEEs on more mainstream architectures like ARM or x86.